SPLK-1003 Practice Test 5 — 25 Questions

Question 1

You need to ensure that a Heavy Forwarder filters out sensitive data before it reaches the Indexer. Which configuration file should be modified?

Accepted Answer

props.conf and transforms.conf. Filtering data happens on the Heavy Forwarder within props.conf and transforms.conf.

Answer

outputs.conf

Answer

server.conf

Answer

inputs.conf

Question 2

A Universal Forwarder reports as 'missing' in the Deployment Server. What is the most common cause?

Accepted Answer

Network firewall or connectivity issue.. A missing forwarder usually indicates a network connectivity issue between the client and the deployment server.

Answer

The forwarder name is too long.

Answer

The index is full.

Answer

The license has expired.

Question 3

Which THREE factors can impact the performance of a Universal Forwarder?

Accepted Answer

Network bandwidth limits. Performance can be impacted by network bandwidth, CPU usage from heavy parsing if misconfigured, and I/O wait on disk.

Answer

Browser type used for access

Answer

The number of users logged in

Question 4

Which of the following is a primary reason to choose a Heavy Forwarder over a Universal Forwarder?

Accepted Answer

Ability to perform index-time parsing. Heavy Forwarders are required when you need to parse data, mask sensitive information, or route data based on content before it reaches the indexer.

Answer

Easier installation

Answer

Native indexing capability

Answer

Lower CPU utilization

Question 5

Which THREE pieces of information can be obtained using the 'splunk fsck' command?

Accepted Answer

Time range of events in a bucket.. fsck is used to repair buckets, check for integrity, and view bucket-level metadata like event counts and time ranges.

Answer

The current user's role.

Answer

Network latency to the indexer.

Question 6

In props.conf, what does the 'REPORT-' prefix signify?

Accepted Answer

It defines a search-time extraction. REPORT- is used to associate a report-time extraction (often defined in transforms.conf) with a sourcetype.

Answer

It triggers an alert

Answer

It defines an index-time extraction

Answer

It defines a line-breaking rule

Question 7

To ensure a Universal Forwarder is using the correct index, where is the 'index' attribute defined?

Accepted Answer

inputs.conf. The index for a data source is defined in inputs.conf.

Answer

props.conf

Answer

outputs.conf

Answer

server.conf

Question 8

What is the effect of setting 'autoLBFrequency' in outputs.conf on a forwarder?

Accepted Answer

Defines the interval for load balancing indexers.. This setting determines how often the forwarder evaluates its load-balancing configuration to redistribute data across multiple indexers.

Answer

Limits the number of simultaneous connections.

Answer

Sets the maximum throughput speed.

Answer

Configures the compression ratio.

Question 9

Which THREE attributes can be used in serverclass.conf to define target clients?

Accepted Answer

whitelist. Filters can be applied using hostnames, IP addresses, or machine classes.

Answer

portFilter

Answer

indexFilter

Question 10

You need to ensure that a Universal Forwarder continues to collect data during a network outage between the forwarder and the indexer. Which feature should be enabled in outputs.conf?

Accepted Answer

Persistent queues. Persistent queuing allows the forwarder to store data locally on disk when the receiving indexer is unreachable.

Answer

Forwarder queue buffering

Answer

Indexer acknowledgment

Answer

Auto-load balancing

Question 11

What happens to Splunk search capabilities when the license limit is reached for the first time in a 30-day period?

Accepted Answer

Search continues to function.. A violation occurs, but search is not blocked on the first occurrence within a rolling 30-day window.

Answer

Data indexing is halted.

Answer

Search is immediately disabled.

Answer

The Splunk service stops.

Question 12

You need to ensure that an index does not exceed 500GB of total disk space. Which configuration setting in indexes.conf should you modify?

Accepted Answer

maxTotalDataSizeMB. maxTotalDataSizeMB is the correct setting to limit the total size of an index on disk.

Answer

maxDataSize

Answer

frozenTimePeriodInSecs

Answer

homePath.maxDataSizeMB

Question 13

Which TWO attributes in props.conf are commonly used to handle multiline events?

Accepted Answer

BREAK_ONLY_BEFORE. BREAK_ONLY_BEFORE and SHOULD_LINEMERGE are used for multiline event processing.

Answer

INDEXED_EXTRACTION

Answer

TIME_FORMAT

Answer

TRANSFORMS-routing

Question 14

You have a deployment server managing 500 Universal Forwarders. You need to update a specific app for only 50 of them based on OS type. How should you organize the deployment?

Accepted Answer

Create two server classes and use machine class filters.. Serverclass.conf allows targeting clients using filters based on machine name or other attributes.

Answer

Use an Intermediate Forwarder for the 50 machines.

Answer

Modify the global serverclass.conf without a class.

Answer

Manually copy the app to the forwarders.

Question 15

How do you restart the Splunk service on a Linux-based Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/bin/splunk restart. The standard command is 'splunk restart'.

Answer

service splunk stop

Answer

kill -9 $(pgrep splunk)

Answer

reboot

Question 16

You are configuring a Heavy Forwarder to mask sensitive credit card information before the data reaches the indexer. Which configuration file must you modify to implement this data transformation?

Accepted Answer

transforms.conf. Data transformations such as routing, filtering, and masking occur on the Heavy Forwarder via transforms.conf and props.conf.

Answer

server.conf

Answer

inputs.conf

Answer

outputs.conf

Question 17

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Accepted Answer

It prevents the input from running. The disabled attribute is used to stop an input from running without deleting the configuration.

Answer

It errors out if the input is not found

Answer

It deletes the input

Answer

It hides the input from the UI

Question 18

Where is the global configuration for Splunk Enterprise stored?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. $SPLUNK_HOME/etc/system/local is the location for global, system-wide configuration overrides.

Answer

$SPLUNK_HOME/etc/users/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/

Question 19

Which TWO of the following are true about 'local' versus 'default' directories?

Accepted Answer

'local' files are preserved during Splunk upgrades. Local overrides default, and local is where changes should be made to survive upgrades.

Answer

Files in 'default' should be edited to update Splunk settings

Answer

'local' directories only exist in the system folder

Answer

'default' files take precedence over 'local'

Question 20

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts should reside within an app directory to ensure they are handled correctly by the deployment server and permissions.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/